@aifabrix/builder 2.53.1 → 2.54.1

package/lib/channels/channel-integration-template.js

@@ -1,6 +1,6 @@
 /**
  * Channel integration templates — copied from templates/channels/<target>/integration/.
- * SSOT for slack: aifabrix-dataplane/integration/slack (make sync-json in dataplane).
+ * SSOT: aifabrix-builder/templates/channels (not dataplane integration/).
  *
  * @fileoverview Template resolution and copy for channel scaffold (plan 152)
  * @author AI Fabrix Team
@@ -42,53 +42,132 @@ function shouldCopyTemplateFile(name) {
 
 /**
  * @param {string} templateDir
- * @returns {string[]}
+ * @returns {string[]} Relative file paths under the template dir
  */
 function listChannelIntegrationTemplateFiles(templateDir) {
   if (!fs.existsSync(templateDir)) {
     return [];
   }
-  return fs
-    .readdirSync(templateDir)
-    .filter((name) => {
-      const full = path.join(templateDir, name);
-      return fs.statSync(full).isFile() && shouldCopyTemplateFile(name);
-    })
-    .sort();
+  return listTemplateFilesRecursive(templateDir, '').sort();
 }
 
 /**
- * @param {string} channelTarget
+ * @param {string} dir
+ * @param {string} prefix
+ * @returns {string[]}
+ */
+function listTemplateFilesRecursive(dir, prefix) {
+  const names = [];
+  for (const name of fs.readdirSync(dir)) {
+    const rel = prefix ? `${prefix}/${name}` : name;
+    const full = path.join(dir, name);
+    const stat = fs.statSync(full);
+    if (stat.isDirectory()) {
+      names.push(...listTemplateFilesRecursive(full, rel));
+      continue;
+    }
+    if (stat.isFile() && shouldCopyTemplateFile(name)) {
+      names.push(rel);
+    }
+  }
+  return names;
+}
+
+const APPLICATION_CONFIG_NAMES = [
+  'application.yaml',
+  'application.yml',
+  'application.json',
+  'variables.yaml'
+];
+
+/**
+ * @param {string} dirPath
+ * @returns {boolean}
+ */
+function isExistingDirectory(dirPath) {
+  try {
+    return fs.existsSync(dirPath) && fs.statSync(dirPath).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * True when the folder has application config and `<target>-system.json`.
+ * Empty leftover directories are not a usable channel scaffold.
+ *
  * @param {string} integrationDir
- * @returns {string[]} Copied file paths
+ * @param {string} channelTarget
+ * @returns {boolean}
  */
-function copyChannelIntegrationTemplate(channelTarget, integrationDir) {
-  const templateDir = getChannelIntegrationTemplateDir(channelTarget);
-  const names = listChannelIntegrationTemplateFiles(templateDir);
-  if (names.length === 0) {
-    throw new Error(
-      `Channel integration template missing for "${channelTarget}" (${templateDir}). ` +
-        'For slack: edit aifabrix-dataplane/integration/slack and run make sync-json. ' +
-        'For other targets: add templates/channels/<target>/integration/ until dataplane SSOT exists.'
-    );
+function hasChannelIntegrationFiles(integrationDir, channelTarget) {
+  if (!integrationDir || typeof integrationDir !== 'string') {
+    return false;
+  }
+  if (!channelTarget || typeof channelTarget !== 'string') {
+    return false;
   }
+  if (!isExistingDirectory(integrationDir)) {
+    return false;
+  }
+  const hasAppConfig = APPLICATION_CONFIG_NAMES.some((name) =>
+    fs.existsSync(path.join(integrationDir, name))
+  );
+  const systemFile = path.join(integrationDir, `${channelTarget}-system.json`);
+  return hasAppConfig && fs.existsSync(systemFile);
+}
 
+/**
+ * @param {string} templateDir
+ * @param {string[]} names
+ * @param {string} integrationDir
+ * @param {boolean} overwrite
+ * @returns {string[]} Copied file paths
+ */
+function copyNamedTemplateFiles(templateDir, names, integrationDir, overwrite) {
   fs.mkdirSync(integrationDir, { recursive: true });
   const copied = [];
   for (const name of names) {
-    const src = path.join(templateDir, name);
     const dest = path.join(integrationDir, name);
-    fs.copyFileSync(src, dest);
+    if (!overwrite && fs.existsSync(dest)) {
+      continue;
+    }
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.copyFileSync(path.join(templateDir, name), dest);
     copied.push(dest);
   }
   return copied;
 }
 
+/**
+ * @param {string} channelTarget
+ * @param {string} integrationDir
+ * @param {{ overwrite?: boolean }} [options]
+ * @returns {string[]} Copied file paths
+ */
+function copyChannelIntegrationTemplate(channelTarget, integrationDir, options = {}) {
+  const templateDir = getChannelIntegrationTemplateDir(channelTarget);
+  const names = listChannelIntegrationTemplateFiles(templateDir);
+  if (names.length === 0) {
+    throw new Error(
+      `Channel integration template missing for "${channelTarget}" (${templateDir}). ` +
+        'Add files under templates/channels/<target>/integration/.'
+    );
+  }
+  return copyNamedTemplateFiles(
+    templateDir,
+    names,
+    integrationDir,
+    options.overwrite === true
+  );
+}
+
 module.exports = {
   BUILDER_ROOT,
   SKIP_TEMPLATE_FILE,
   getChannelIntegrationTemplateDir,
   shouldCopyTemplateFile,
   listChannelIntegrationTemplateFiles,
+  hasChannelIntegrationFiles,
   copyChannelIntegrationTemplate
 };

package/lib/channels/channel-inventory-fetch.js

@@ -0,0 +1,79 @@
+/**
+ * List Dataplane Connected Systems for channel inventory projection.
+ *
+ * @fileoverview Builder-side Dataplane list — fail closed
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { listExternalSystems } = require('../api/external-systems.api');
+const { unwrapApiData } = require('../utils/external-system-readiness-core');
+const { httpError } = require('../programmatic/channel-install-session');
+
+/** Dataplane listExternalSystems pageSize maximum is 100. */
+const INVENTORY_PAGE_SIZE = 100;
+const INVENTORY_MAX_PAGES = 50;
+
+/**
+ * @param {Object} res
+ * @returns {Object[]}
+ */
+function systemsFromListResponse(res) {
+  const data = unwrapApiData(res);
+  if (Array.isArray(data)) {
+    return data;
+  }
+  if (data && Array.isArray(data.items)) {
+    return data.items;
+  }
+  if (data && Array.isArray(data.data)) {
+    return data.data;
+  }
+  return [];
+}
+
+/**
+ * Channel identity lives on config.extensions.channel / system.channel.
+ * Slim list drops those unless includeConfig is true.
+ *
+ * @param {import('../programmatic/workspace-context').WorkspaceContext} ctx
+ * @param {Object} [deps]
+ * @returns {Promise<Object[]>}
+ */
+async function listConnectedSystemsForInventory(ctx, deps = {}) {
+  const list = deps.listExternalSystems || listExternalSystems;
+  const auth = {
+    type: 'bearer',
+    token: ctx.bearerToken,
+    preserveBearer: true
+  };
+  const systems = [];
+  try {
+    for (let page = 1; page <= INVENTORY_MAX_PAGES; page += 1) {
+      const res = await list(ctx.dataplaneUrl, auth, {
+        page,
+        pageSize: INVENTORY_PAGE_SIZE,
+        includeConfig: true
+      });
+      const chunk = systemsFromListResponse(res);
+      systems.push(...chunk);
+      if (chunk.length < INVENTORY_PAGE_SIZE) {
+        return systems;
+      }
+    }
+    return systems;
+  } catch (err) {
+    throw httpError(
+      `Unable to list Connected Systems for channel inventory: ${err.message}`,
+      err.statusCode || 502
+    );
+  }
+}
+
+module.exports = {
+  listConnectedSystemsForInventory,
+  systemsFromListResponse,
+  INVENTORY_PAGE_SIZE
+};

package/lib/channels/channel-oauth-preflight.js

@@ -0,0 +1,104 @@
+/**
+ * Authorization preflight for Predefined Client channel installs.
+ *
+ * @fileoverview GET /api/v1/auth/permissions only — never probe create/update
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getAuthPermissions } = require('../api/auth.api');
+const { httpError } = require('../programmatic/channel-install-session');
+
+const PREDEFINED_CLIENT_DEFINITIONS = new Set(['microsoft-copilot', 'mcp-client']);
+const REQUIRED_SLUGS = Object.freeze(['integration-client:read', 'integration-client:create']);
+
+/**
+ * @param {string} definitionKey
+ * @returns {boolean}
+ */
+function needsIntegrationClientPreflight(definitionKey) {
+  return PREDEFINED_CLIENT_DEFINITIONS.has(definitionKey);
+}
+
+/**
+ * @param {unknown} response
+ * @returns {string[]}
+ */
+function permissionSlugsFromResponse(response) {
+  const body = response && response.data !== undefined ? response.data : response;
+  const inner = body && body.data !== undefined && body.data !== null ? body.data : body;
+  if (Array.isArray(inner)) {
+    return inner.filter((item) => typeof item === 'string');
+  }
+  if (inner && Array.isArray(inner.permissions)) {
+    return inner.permissions.filter((item) => typeof item === 'string');
+  }
+  if (body && Array.isArray(body.permissions)) {
+    return body.permissions.filter((item) => typeof item === 'string');
+  }
+  return [];
+}
+
+/**
+ * @param {unknown} errOrResponse
+ * @returns {Error}
+ */
+function toForbiddenError(errOrResponse) {
+  const status = Number(
+    errOrResponse && (errOrResponse.statusCode || errOrResponse.status)
+  );
+  const message =
+    (errOrResponse && (errOrResponse.formattedError || errOrResponse.message)) ||
+    'Missing integration-client:read. Cannot start channel install.';
+  if (status === 403 || /integration-client:/i.test(String(message))) {
+    return httpError(String(message), 403);
+  }
+  return httpError(String(message), status >= 400 && status < 600 ? status : 502);
+}
+
+/**
+ * Fail closed before wizard/install when Integration Client permissions are missing.
+ * Does not attempt create/update. Does not invent a Builder permission catalog.
+ * @param {import('../programmatic/workspace-context').WorkspaceContext} ctx
+ * @param {string} definitionKey
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function assertIntegrationClientPermissions(ctx, definitionKey, deps = {}) {
+  if (!needsIntegrationClientPreflight(definitionKey)) {
+    return;
+  }
+  const getPerms = deps.getAuthPermissions || getAuthPermissions;
+  let response;
+  try {
+    response = await getPerms(
+      ctx.controllerUrl,
+      { type: 'bearer', token: ctx.bearerToken, preserveBearer: true },
+      ctx.environment
+    );
+  } catch (err) {
+    throw toForbiddenError(err);
+  }
+  if (response && (response.success === false || Number(response.status) === 403)) {
+    throw toForbiddenError(response);
+  }
+  const slugs = permissionSlugsFromResponse(response);
+  const missing = REQUIRED_SLUGS.filter((slug) => !slugs.includes(slug));
+  if (missing.length === 0) {
+    return;
+  }
+  throw httpError(
+    `Missing ${missing.join(', ')}. Cannot start channel install.`,
+    403
+  );
+}
+
+module.exports = {
+  PREDEFINED_CLIENT_DEFINITIONS,
+  REQUIRED_SLUGS,
+  needsIntegrationClientPreflight,
+  permissionSlugsFromResponse,
+  assertIntegrationClientPermissions
+};

package/lib/channels/channel-package-version.js

@@ -0,0 +1,76 @@
+/**
+ * Channel package semver for in-place vendor updates.
+ *
+ * @fileoverview First write is 1.0.0; later writes bump minor (1.0.0 → 1.1.0)
+ */
+
+'use strict';
+
+/**
+ * @param {string} version
+ * @returns {{ major: number, minor: number, patch: number }|null}
+ */
+function parseSemverTriple(version) {
+  const match = String(version || '')
+    .trim()
+    .match(/^(\d+)\.(\d+)\.(\d+)$/);
+  if (!match) {
+    return null;
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3])
+  };
+}
+
+/**
+ * Vendor updates need a higher package version — bump minor (1.0.0 → 1.1.0).
+ * @param {string} version
+ * @returns {string}
+ */
+function bumpMinorPackageVersion(version) {
+  const parts = parseSemverTriple(version);
+  if (!parts) {
+    return '1.1.0';
+  }
+  return `${parts.major}.${parts.minor + 1}.0`;
+}
+
+/**
+ * @param {string|null|undefined} explicitVersion
+ * @param {string|null} priorVersion
+ * @returns {string}
+ */
+function resolvePackageVersionForWrite(explicitVersion, priorVersion) {
+  if (typeof explicitVersion === 'string' && explicitVersion.trim()) {
+    return explicitVersion.trim();
+  }
+  if (priorVersion) {
+    return bumpMinorPackageVersion(priorVersion);
+  }
+  return '1.0.0';
+}
+
+/**
+ * Slack re-install writes a new package version unless the caller set one.
+ * @param {string} channelTarget
+ * @param {Object} options
+ * @param {Object|null} existing
+ * @returns {void}
+ */
+function applySlackPackageVersion(channelTarget, options, existing) {
+  if (channelTarget !== 'slack' || !options || typeof options !== 'object') {
+    return;
+  }
+  const prior =
+    existing && typeof existing.packageVersion === 'string' ? existing.packageVersion : null;
+  options.packageVersion = resolvePackageVersionForWrite(options.packageVersion, prior);
+}
+
+module.exports = {
+  parseSemverTriple,
+  bumpMinorPackageVersion,
+  resolvePackageVersionForWrite,
+  applySlackPackageVersion
+};

package/lib/channels/channel-predefined-client.js

@@ -0,0 +1,154 @@
+/**
+ * Per-install Predefined Client clone (Copilot / mcp-client pattern).
+ *
+ * @fileoverview Create/reuse instance Integration Client; never rotate catalog
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { slugDisplayName, clipInstanceKey } = require('./channel-instance-key');
+const { ensureMcpClientIntegrationClient } = require('./mcp-client/ensure-client');
+
+const MS_COPILOT_CATALOG_KEY = 'ms-copilot';
+const MS_COPILOT_REDIRECT_URIS = Object.freeze([
+  'https://copilot.microsoft.com/oauth/callback',
+  'https://global.consent.azure-apim.net/redirect',
+  'https://global.consent.azure-apim.net/redirect/*',
+  'https://europe.consent.azure-apim.net/redirect',
+  'https://europe.consent.azure-apim.net/redirect/*'
+]);
+
+/**
+ * Controller environment infix. Production omits the segment.
+ * @param {string} [environment]
+ * @returns {string}
+ */
+function environmentInfix(environment) {
+  const raw = String(environment || '').trim().toLowerCase();
+  if (!raw || raw === 'prod' || raw === 'production' || raw === 'live') {
+    return '';
+  }
+  if (raw === 'test') {
+    return 'tst';
+  }
+  return raw.replace(/[^a-z0-9]+/g, '').slice(0, 8);
+}
+
+/**
+ * Instance Integration Client key. key and keycloakClientId match.
+ * @param {string} catalogKey
+ * @param {string} [environment]
+ * @param {string} slug
+ * @returns {string}
+ */
+function predefinedClientInstanceKey(catalogKey, environment, slug) {
+  const infix = environmentInfix(environment);
+  const parts = infix ? [catalogKey, infix, slug] : [catalogKey, slug];
+  return clipInstanceKey(parts.join('-'));
+}
+
+/**
+ * @param {Object} params
+ * @returns {string}
+ */
+function copilotInstallClientKey(params) {
+  const slug = slugDisplayName(params.baseName || params.name || params.appName);
+  return predefinedClientInstanceKey(MS_COPILOT_CATALOG_KEY, params.environment, slug);
+}
+
+/**
+ * @param {string} [controllerUrl]
+ * @param {string} clientKey
+ * @returns {{ oauth2ProfileId: string, oauth2ProfilePath: string, oauth2ProfileUrl?: string }}
+ */
+function oauth2ProfileFromClientKey(controllerUrl, clientKey) {
+  const oauth2ProfilePath = `/external-access/oauth2-profiles/${clientKey}`;
+  const resolved = { oauth2ProfileId: clientKey, oauth2ProfilePath };
+  if (typeof controllerUrl === 'string' && controllerUrl.trim()) {
+    resolved.oauth2ProfileUrl = `${controllerUrl.replace(/\/$/, '')}${oauth2ProfilePath}`;
+  }
+  return resolved;
+}
+
+function applyCopilotRuntimeDomain(resolved) {
+  resolved.runtimeDomain = '';
+  try {
+    resolved.runtimeDomain = new URL(resolved.mcpUrl).hostname;
+  } catch {
+    try {
+      resolved.runtimeDomain = new URL(resolved.dataplaneBaseUrl).hostname;
+    } catch {
+      resolved.runtimeDomain = '';
+    }
+  }
+}
+
+/**
+ * Apply instance OAuth2 profile URLs on Copilot runtime values (deterministic key).
+ * @param {Object} resolved
+ * @param {Object} params
+ * @returns {void}
+ */
+function applyCopilotOauthProfile(resolved, params) {
+  const slug = slugDisplayName(params.baseName || params.appName);
+  if (!slug) {
+    return;
+  }
+  Object.assign(
+    resolved,
+    oauth2ProfileFromClientKey(params.controllerUrl, copilotInstallClientKey({
+      baseName: params.baseName,
+      appName: params.appName,
+      environment: params.environment || resolved.environment
+    }))
+  );
+}
+
+/**
+ * Create or reuse the per-install client. Never regenerate-secret. Never touch catalog miso-ms-copilot.
+ * @param {Object} params
+ * @returns {Promise<{ client: Object, created: boolean, added: boolean, clientKey: string }|null>}
+ */
+async function ensureCopilotInstallClient(params) {
+  if (params.options && params.options.dryRun === true) {
+    return null;
+  }
+  const ctx = params.ctx;
+  if (!ctx || !ctx.controllerUrl || !ctx.authConfig) {
+    return null;
+  }
+  const clientKey = copilotInstallClientKey({
+    name: params.name,
+    baseName: params.baseName,
+    environment: ctx.environment
+  });
+  const profile = {
+    key: clientKey,
+    displayName: `MS Copilot (${params.name || clientKey})`,
+    oauth: {
+      integrationClientKey: clientKey,
+      keycloakClientId: clientKey,
+      redirectUris: [...MS_COPILOT_REDIRECT_URIS]
+    }
+  };
+  const ensured = await ensureMcpClientIntegrationClient({
+    ctx,
+    profile,
+    deps: params.deps || {}
+  });
+  return { ...ensured, clientKey };
+}
+
+module.exports = {
+  MS_COPILOT_CATALOG_KEY,
+  MS_COPILOT_REDIRECT_URIS,
+  environmentInfix,
+  predefinedClientInstanceKey,
+  copilotInstallClientKey,
+  oauth2ProfileFromClientKey,
+  applyCopilotOauthProfile,
+  applyCopilotRuntimeDomain,
+  ensureCopilotInstallClient
+};

package/lib/channels/channel-probe.js

@@ -11,6 +11,7 @@
 const { ApiClient, createDataplaneApiClient } = require('../api/index');
 const { fetchDataplaneGeneralHealth } = require('../api/dataplane-health.api');
 const { resolveChannelRuntimeValues } = require('./channel-runtime-resolver');
+const { vendorFacingUrlsFromCtx } = require('./vendor-dataplane-url');
 const {
   fetchRuntimeLayerBToolNames,
   isRuntimeMcpGatewayReachable
@@ -149,8 +150,10 @@ async function buildChatGptProbeDetails(
   layerBToolNames,
   catalogItems = []
 ) {
+  const vendor = vendorFacingUrlsFromCtx(ctx);
   const runtime = resolveChannelRuntimeValues({
-    dataplaneBaseUrl: ctx.dataplaneUrl,
+    dataplaneBaseUrl: vendor.dataplaneBaseUrl,
+    controllerUrl: vendor.controllerUrl,
     channelTarget: 'chatgpt',
     appName: channelExt?.name || 'chatgpt',
     baseName: channelExt?.baseName || channelExt?.name || 'chatgpt',
@@ -181,8 +184,10 @@ async function buildChatGptProbeDetails(
  * @returns {Promise<{ probeTiers: Object, runtimeChecks: Object }>}
  */
 async function buildMicrosoftCopilotProbeDetails(ctx, channelExt, catalogOk, layerBToolNames) {
+  const vendor = vendorFacingUrlsFromCtx(ctx);
   const runtime = resolveChannelRuntimeValues({
-    dataplaneBaseUrl: ctx.dataplaneUrl,
+    dataplaneBaseUrl: vendor.dataplaneBaseUrl,
+    controllerUrl: vendor.controllerUrl,
     channelTarget: 'microsoft-copilot',
     appName: channelExt?.name || 'microsoft-copilot',
     baseName: channelExt?.baseName || channelExt?.name || 'microsoft-copilot',